Skip to content

Commit 3fa40d0

Browse files
rbsecrbsec
committed
Updates to IANA/RFC cipher suite names based on PR from @77ORO 
1 parent 374a594 commit 3fa40d0

File tree

5 files changed

+65
-14
lines changed

5 files changed

+65
-14
lines changed

‎Changelog

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
Changelog
22
=========
3+
Version: 2.0.11
4+
Date : 16/12/2021
5+
Author : rbsec <[email protected]>
6+
Changes: The following are a list of changes
7+
> Add --iana-names option to use IANA/RFC cipher names
8+
> Improve signature algorithm detection
9+
310
Version: 2.0.10
411
Date : 27/04/2021
512
Author : rbsec <[email protected]>

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ Key changes are as follows:
7070
* Support STARTTLS for MySQL (credit bk2017).
7171
* Check for supported key exchange groups.
7272
* Check for supported server signature algorithms.
73+
* Display IANA/RFC cipher names `--iana-names`
7374

7475
### Building on Linux
7576

‎sslscan.1

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ Show a complete list of ciphers supported by sslscan
6060
.B \-\-show\-cipher-ids
6161
Print the hexadecimal cipher IDs
6262
.TP
63+
.B \-\-iana\-names
64+
Use IANA/RFC cipher names rather than OpenSSL ones
65+
.TP
6366
.B \-\-show\-times
6467
Show the time taken for each handshake in milliseconds. Note that only a single request is made with each cipher, and that the size of the ClientHello is not constant, so this should not be used for proper benchmarking or performance testing.
6568

‎sslscan.c

Lines changed: 53 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1746,28 +1746,68 @@ void outputCipher(struct sslCheckOptions *options, SSL *ssl, const char *cleanSs
17461746

17471747
printf_xml(" bits=\"%d\" cipher=\"%s\" id=\"%s\"", cipherbits, ciphername, hexCipherId);
17481748
if (strstr(ciphername, "NULL")) {
1749-
printf("%s%-45s%s", COL_RED_BG, ciphername, RESET);
1749+
if (options->ianaNames) {
1750+
printf("%s%-45s%s", COL_RED_BG, ciphername, RESET);
1751+
}
1752+
else {
1753+
printf("%s%-29s%s", COL_RED_BG, ciphername, RESET);
1754+
}
17501755
strength = "null";
17511756
} else if (strstr(ciphername, "ADH") || strstr(ciphername, "AECDH") || strstr(ciphername, "_anon_")) {
1752-
printf("%s%-45s%s", COL_PURPLE, ciphername, RESET);
1757+
if (options->ianaNames) {
1758+
printf("%s%-45s%s", COL_PURPLE, ciphername, RESET);
1759+
}
1760+
else {
1761+
printf("%s%-29s%s", COL_PURPLE, ciphername, RESET);
1762+
}
17531763
strength = "anonymous";
17541764
} else if (strstr(ciphername, "EXP")) {
1755-
printf("%s%-45s%s", COL_RED, ciphername, RESET);
1765+
if (options->ianaNames) {
1766+
printf("%s%-45s%s", COL_RED, ciphername, RESET);
1767+
}
1768+
else {
1769+
printf("%s%-29s%s", COL_RED, ciphername, RESET);
1770+
}
17561771
strength = "weak";
17571772
} else if (strstr(ciphername, "RC4") || strstr(ciphername, "DES")) {
1758-
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1773+
if (options->ianaNames) {
1774+
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1775+
}
1776+
else {
1777+
printf("%s%-29s%s", COL_YELLOW, ciphername, RESET);
1778+
}
17591779
strength = "medium";
17601780
} else if (strstr(ciphername, "_SM4_")) { /* Developed by Chinese government */
1761-
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1781+
if (options->ianaNames) {
1782+
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1783+
}
1784+
else {
1785+
printf("%s%-29s%s", COL_YELLOW, ciphername, RESET);
1786+
}
17621787
strength = "medium";
17631788
} else if (strstr(ciphername, "_GOSTR341112_")) { /* Developed by Russian government */
1764-
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1789+
if (options->ianaNames) {
1790+
printf("%s%-45s%s", COL_YELLOW, ciphername, RESET);
1791+
}
1792+
else {
1793+
printf("%s%-29s%s", COL_YELLOW, ciphername, RESET);
1794+
}
17651795
strength = "medium";
17661796
} else if ((strstr(ciphername, "CHACHA20") || (strstr(ciphername, "GCM"))) && strstr(ciphername, "DHE")) {
1767-
printf("%s%-45s%s", COL_GREEN, ciphername, RESET);
1797+
if (options->ianaNames) {
1798+
printf("%s%-45s%s", COL_GREEN, ciphername, RESET);
1799+
}
1800+
else {
1801+
printf("%s%-29s%s", COL_GREEN, ciphername, RESET);
1802+
}
17681803
strength = "strong";
17691804
} else {
1770-
printf("%-45s", ciphername);
1805+
if (options->ianaNames) {
1806+
printf("%-45s", ciphername);
1807+
}
1808+
else {
1809+
printf("%-29s", ciphername);
1810+
}
17711811
strength = "acceptable";
17721812
}
17731813
printf_xml(" strength=\"%s\"", strength);
@@ -1848,7 +1888,7 @@ int testCipher(struct sslCheckOptions *options, const SSL_METHOD *sslMethod)
18481888
cipherid = SSL_CIPHER_get_id(sslCipherPointer);
18491889
cipherid = cipherid & 0x00ffffff; // remove first byte which is the version (0x03 for TLSv1/SSLv3)
18501890

1851-
if (options->rfcNames)
1891+
if (options->ianaNames)
18521892
{
18531893
ciphername = SSL_CIPHER_standard_name(sslCipherPointer);
18541894
}
@@ -3930,9 +3970,9 @@ int main(int argc, char *argv[])
39303970
else if (strcmp("--show-sigs", argv[argLoop]) == 0)
39313971
options->signature_algorithms = true;
39323972

3933-
// Show RFC algorithms names in output
3934-
else if (strcmp("--show-rfc-names", argv[argLoop]) == 0)
3935-
options->rfcNames = true;
3973+
// Show IANA/RFC cipher names in output
3974+
else if (strcmp("--iana-names", argv[argLoop]) == 0)
3975+
options->ianaNames = true;
39363976

39373977
// StartTLS... FTP
39383978
else if (strcmp("--starttls-ftp", argv[argLoop]) == 0)
@@ -4197,7 +4237,6 @@ int main(int argc, char *argv[])
41974237
printf("\n");
41984238
printf(" %s--show-certificate%s Show full certificate information\n", COL_GREEN, RESET);
41994239
printf(" %s--show-client-cas%s Show trusted CAs for TLS client auth\n", COL_GREEN, RESET);
4200-
printf(" %s--show-rfc-names%s Show RFC cipher names instead of OpenSSL\n", COL_GREEN, RESET);
42014240
printf(" %s--no-check-certificate%s Don't warn about weak certificate algorithm or keys\n", COL_GREEN, RESET);
42024241
printf(" %s--ocsp%s Request OCSP response from server\n", COL_GREEN, RESET);
42034242
printf(" %s--pk=<file>%s A file containing the private key or a PKCS#12 file\n", COL_GREEN, RESET);
@@ -4216,6 +4255,7 @@ int main(int argc, char *argv[])
42164255
printf(" %s--tlsall%s Only check TLS ciphers (all versions)\n", COL_GREEN, RESET);
42174256
printf(" %s--show-ciphers%s Show supported client ciphers\n", COL_GREEN, RESET);
42184257
printf(" %s--show-cipher-ids%s Show cipher ids\n", COL_GREEN, RESET);
4258+
printf(" %s--iana-names%s Use IANA/RFC cipher names rather than OpenSSL ones\n", COL_GREEN, RESET);
42194259
printf(" %s--show-times%s Show handhake times in milliseconds\n", COL_GREEN, RESET);
42204260
printf("\n");
42214261
#if OPENSSL_VERSION_NUMBER >= 0x10002000L

‎sslscan.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ struct sslCheckOptions
182182
int ipv4;
183183
int ipv6;
184184
int ocspStatus;
185-
int rfcNames;
185+
int ianaNames;
186186
char cipherstring[65536];
187187

188188
// File Handles...

0 commit comments

Comments
 (0)